Meta's Muse faces serious security flaw

Meta's new AI assistant Muse, which books appointments and makes purchases, contains a zero-day vulnerability that lets any app or terminal command gain complete control of user accounts.

What Muse can do for users

Muse books appointments, fills out forms, handles customer service, makes purchases, generates images, creates documents, and connects with apps and services. It works with WhatsApp, email, calendars, and social media accounts on macOS.

Muse requires extensive permissions

To function, Muse needs access to user accounts and broad macOS permissions including file writing, microphone, camera, location, and calendar access. Apple built these defenses to prevent installed apps from accessing sensitive resources.

The vulnerability explained

Any app or command can change undocumented Muse settings, including one that controls where voice transcription happens. Attackers can redirect this to their own server to steal the authentication token that controls the entire account.

Attacker's perspective on the flaw

Security researcher Patrick Wardle said attackers can leverage Muse's privileges to do whatever they want, including writing malicious files and taking pictures, often with no indication to the user.

“We can manipulate the agent and leverage its privileges to do whatever we want.”

Meta's delayed response

More than 12 hours after the vulnerability was disclosed, Meta released a hotfix to patch the zero-day. The company had previously published posts claiming Muse was designed with security and privacy in mind.

Design decisions enabled the attack

Meta chose cloud-based transcription so it could log voice data, rather than using macOS's built-in on-device transcription. It also allowed any app to control all undocumented settings, not just UI controls.

Wardle's security concerns

Wardle criticized Meta for not thinking about security from the start, saying the bar should be infinitely higher for apps with such extraordinary access to user data and resources.

“They didn't, in my opinion, think about security, which is really worrisome.”

Amazon blocks Muse from shopping

About 12 hours before the vulnerability was disclosed, Amazon began blocking Muse from its site, calling it an unauthorized AI agent that violates its conditions of use.

How attackers can exploit it

An attacker's server can act as a proxy between Muse and Meta's endpoint. When a user enters a voice prompt, the attacker injects a malicious command, then gains the authentication token for permanent account control.

ClickFix attack makes it easy

A simple variation of the ClickFix social engineering scam is all that's needed to trigger the exploit. Meta's statement ignored this ease of exploitation, claiming the flaw is not a remote exploit.

Wardle's background and plans

Patrick Wardle founded the Objective-See Foundation focused on macOS security and authored the Art of Mac Malware book series. He plans to discuss this vulnerability and other AI assistant threats at the Objective by the Sea conference in November.

Muse cannot be trusted yet

The extraordinary access Muse requires places an additional burden on its designers. Despite Meta's claims, Muse cannot be trusted, and it's unclear when or if it ever can be.